VPN: WireGuard and AmneziaWG

A VPN in Liminal is not the VPN of your computer. The tunnel belongs to the profiles that use it: the app creates no network interface, changes no routes, installs no driver and asks for no administrator rights. Other apps, and other profiles, are not affected by it.

1. Open Connections and press Add Proxy or VPN.
2. Paste the text of the configuration, or drop its .conf file onto the sheet.
3. The sheet checks that the tunnel answers, and you press Add.

[Interface]
PrivateKey = <your private key>
Address = 10.0.0.2/32
DNS = 10.0.0.1

[Peer]
PublicKey = <the server’s public key>
Endpoint = vpn.example.net:51820
AllowedIPs = 0.0.0.0/0, ::/0

A configuration with anything else — PreUp and PostUp scripts, Table and the like — is refused: the app does not run commands from a file. The file may be up to 64 KB.

A profile on a VPN resolves names only through the DNS servers written in the configuration. There is no falling back to the resolver of your system, so a configuration without a reachable DNS loads nothing rather than leak.

A VPN is assigned to profiles the same way as a proxy — see Assign to profiles. It is checked every time a profile opens through it, and a profile does not open through a tunnel that does not answer.

Open the connection to see what was read from the configuration: Addresses, DNS servers, MTU, Public key, Peer public key, Allowed IPs and Persistent keepalive. These rows are for reading; to change a tunnel, add the new configuration.

The export of the Connections page skips VPNs. A configuration is exported from its own sheet with Export configuration, after a confirmation.